Skip to main content

Sina Extension EUVDEUVD-2026-49077

| CVE-2026-14190 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-07-27 WPScan GHSA-j952-f3p9-h3jg
XSS WordPress Sina Extension For Elementor
6.1
CVSS 3.1 · Vendor: WPScan
Share

Severity by source

Vendor (WPScan) PRIMARY
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vuln.today AI
6.1 MEDIUM

AV:N network, AC:L no special conditions, PR:N unauthenticated, UI:R required, S:C scope changed, C:L I:L low impact

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:R/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

5
Analysis Generated
Jul 27, 2026 - 16:27 vuln.today
CVSS changed
Jul 27, 2026 - 16:22 NVD
6.1 (MEDIUM)
Patch available
Jul 27, 2026 - 07:01 EUVD
CVE Published
Jul 27, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 27, 2026 - 06:00 cve.org
MEDIUM 6.1

DescriptionCVE.org

The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who triggers a crafted request.

AnalysisAI

Reflected XSS in the Sina Extension for Elementor WordPress plugin allows unauthenticated attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability exists in an unauthenticated AJAX handler that fails to escape user input before reflecting it. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft malicious URL with XSS payload
Delivery
Send to victim via phishing
Exploit
Victim clicks link
Execution
AJAX handler reflects unsanitized input
Persist
JavaScript executes in victim's browser
Impact
Attacker steals session or performs actions as user
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The vulnerability is accessible to unauthenticated remote attackers via the AJAX endpoint. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS 3.1 score 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates a network-accessible, low-complexity attack that requires user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a URL containing a malicious JavaScript payload that triggers the vulnerable AJAX handler. The URL is sent to a site administrator via email or social engineering. …
Remediation Update the Sina Extension for Elementor plugin to version 3.10.2 or later, which patches the unescaped output in the AJAX handler. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Sina Extension For Elementor

View all
CVE-2024-34384 HIGH
8.8 Jun 04

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SinaExtra Sina Extension
CVE-2019-15839 HIGH
7.5 Aug 30

The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion. Rated high severity (CVSS 7
CVE-2024-29935 MEDIUM
6.5 Mar 27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SinaExtra Sina Ext
CVE-2024-4373 MEDIUM
6.4 May 15

The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elem
CVE-2024-5036 MEDIUM
6.4 Jun 20

The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elem
CVE-2025-1517 MEDIUM
6.4 Feb 26

The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elem
CVE-2024-5260 MEDIUM
6.4 Jul 02

The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elem
CVE-2024-4333 MEDIUM
6.4 May 14

The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elem
CVE-2024-3988 MEDIUM
6.4 Apr 25

The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elem
CVE-2024-35703 MEDIUM
5.4 Jun 08

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SinaExtra S
CVE-2021-24269 MEDIUM
5.4 May 05

The “Sina Extension for Elementor” WordPress Plugin before 3.3.12 has several widgets that are vulnerable to stored Cros
CVE-2024-9540 MEDIUM
4.3 Oct 16

The Sina Extension for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

EUVD-2026-49077 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy